@raclettejs/core 0.1.18 → 0.1.20

package/services/backend/src/core/sockets/workSessionJoinPayload.ts

@@ -0,0 +1,106 @@
+import { v4 as uuidv4 } from "uuid"
+
+/**
+ * Builds the joinConfirmation payload shape for work-session guests.
+ * Keeps virtual composition and simulated interaction-link logic out of socketManager.
+ */
+
+interface WorkSessionLike {
+  _id: string
+  userId: string
+  createdAt?: Date | string
+  updatedAt?: Date | string
+  [key: string]: unknown
+}
+
+interface CompositionLike {
+  title?: string
+  description?: string
+  tags?: unknown[]
+  icon?: string
+  slotLayout?: string
+  widgetsLayout?: unknown[]
+  status?: string
+  createdAt?: string
+  updatedAt?: string
+  [key: string]: unknown
+}
+
+/** Virtual composition sent to frontend (pathname.default matches route /:workSession/id=...) */
+function buildVirtualComposition(
+  composition: CompositionLike,
+  workSession: WorkSessionLike,
+): Record<string, unknown> {
+  const now = new Date()
+  return {
+    _id: uuidv4(),
+    title: composition.title ?? "Shared Session",
+    description:
+      composition.description ?? "Shared composition for anonymous access",
+    tags: composition.tags ?? [],
+    icon: composition.icon,
+    pathname: { default: "workSession" },
+    slotLayout: composition.slotLayout ?? "full",
+    widgetsLayout: composition.widgetsLayout ?? [],
+    status: composition.status ?? "live",
+    author: workSession.userId,
+    lastEditor: workSession.userId,
+    isDeleted: false,
+    createdAt: composition.createdAt ?? now.toISOString(),
+    updatedAt: composition.updatedAt ?? now.toISOString(),
+  }
+}
+
+/** Simulated interaction link so the frontend can resolve the composition like a normal project. */
+function buildSimulatedInteractionLink(
+  workSession: WorkSessionLike,
+  virtualComposition: { _id: string; [key: string]: unknown },
+): Record<string, unknown> {
+  const created = workSession.createdAt
+    ? new Date(workSession.createdAt)
+    : new Date()
+  const updated = workSession.updatedAt
+    ? new Date(workSession.updatedAt)
+    : new Date()
+  return {
+    _id: `session_${workSession._id}_interactionLink`,
+    composition: virtualComposition._id,
+    slotType: "page",
+    triggers: [],
+    queryParameters: [],
+    description: "Shared session composition",
+    tags: [],
+    author: workSession.userId,
+    lastEditor: workSession.userId,
+    isLandingPage: true,
+    isDeleted: false,
+    createdAt: created,
+    updatedAt: updated,
+  }
+}
+
+export interface WorkSessionJoinPayloadData {
+  compositions: unknown[]
+  interactionLinks: unknown[]
+  projectConfig: Record<string, unknown>
+}
+
+/**
+ * Build the data part of joinConfirmation for a work session (no token).
+ * Socket manager adds token and decoded after creating the JWT.
+ */
+export function buildWorkSessionJoinPayload(
+  workSession: WorkSessionLike,
+  composition: CompositionLike,
+): WorkSessionJoinPayloadData {
+  const virtualComposition = buildVirtualComposition(composition, workSession)
+  const simulatedInteractionLink = buildSimulatedInteractionLink(
+    workSession,
+    virtualComposition as { _id: string; [key: string]: unknown },
+  )
+  return {
+    compositions: [virtualComposition],
+    interactionLinks: [simulatedInteractionLink],
+    projectConfig: {},
+  }
+}

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.get.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import { Type } from "@sinclair/typebox"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.getAll.ts

@@ -1,6 +1,8 @@
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const accountService = fastify.custom.accountService
 
@@ -20,7 +22,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.hardDelete.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -18,29 +19,25 @@ export default (fastify: PluginFastifyInstance) => {
     }>,
     reply: FastifyReply,
   ) => {
-    if (req.user.isAdmin) {
-      try {
-        const { _id } = req.params
-
-        const payload = await accountService.hardDeleteAccount(
-          fastify,
-          req.requestParams,
-          _id,
-        )
-
-        return payload
-      } catch (error: any) {
-        fastify.log.error(error.message)
-        return reply.internalServerError(error.message)
-      }
-    } else {
-      throw new ForbiddenError("Only admins can hard delete this core datatype")
+    try {
+      const { _id } = req.params
+
+      const payload = await accountService.hardDeleteAccount(
+        fastify,
+        req.requestParams,
+        _id,
+      )
+
+      return payload
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return reply.internalServerError(error.message)
     }
   }
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataHardDeleted",
       broadcastChannels: ["accountHardDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.patch.ts

@@ -5,6 +5,8 @@ import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 import { accountSchema } from "../account.schema"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -40,7 +42,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataUpdate",
       broadcastChannels: ["accountUpdated", "broadcastDataUpdated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.post.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { accountSchema } from "../account.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const accountService = fastify.custom.accountService
 
@@ -29,7 +31,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["accountCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/account/routes/route.account.remove.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -35,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataDelete",
       broadcastChannels: ["accountDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/composition.service.ts

@@ -94,11 +94,10 @@ export class CompositionService {
    */
   async _readAllCompositions(
     fastify: PluginFastifyInstance,
-    filters: Record<string, any> = {},
+    filters: Record<string, any> = { isDeleted: false },
   ): Promise<CompositionType[]> {
     try {
-      if (filters.isDeleted !== true && filters.isDeleted !== "true")
-        filters.isDeleted = false
+      filters = { isDeleted: false, ...filters }
       return await this.compositionModel
         .find({
           ...filters,
@@ -337,6 +336,90 @@ export class CompositionService {
     payload.body.deleted = [composition._id]
     fastify.emit("compositionHardDeleted", payload)
 
+    return payload
+  }
+  /**
+   * Core function to create multiple compositions (returns raw data)
+   */
+  async _createCompositions(
+    fastify: PluginFastifyInstance,
+    compositionBodies: CompositionBody[],
+    userId: string,
+  ): Promise<CompositionType[]> {
+    try {
+      const compositionsToCreate: CompositionBody[] = []
+
+      // Validate and prepare all compositions
+      for (const compositionBody of compositionBodies) {
+        if (compositionBody._id) {
+          const uuidValid = validate(compositionBody._id)
+
+          if (!uuidValid) {
+            throw new Error(
+              `Invalid ID - not a valid uuid v4: ${compositionBody._id}`,
+            )
+          }
+
+          const duplicate = await this.compositionModel.findOne({
+            _id: compositionBody._id,
+          })
+
+          if (duplicate) {
+            throw new Error(
+              `An entry with this id already exists: ${compositionBody._id}`,
+            )
+          }
+        } else {
+          compositionBody._id = uuidv4()
+        }
+
+        compositionsToCreate.push({
+          ...compositionBody,
+          author: userId,
+          lastEditor: userId,
+        })
+      }
+
+      // Bulk insert
+      const compositions =
+        await this.compositionModel.insertMany(compositionsToCreate)
+
+      fastify.log.info(
+        `[API] Created ${compositions.length} compositions in bulk`,
+      )
+
+      return compositions.map((comp) =>
+        comp.toObject ? comp.toObject() : comp,
+      )
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      throw error
+    }
+  }
+
+  /**
+   * Create multiple compositions with payload wrapping and event emission
+   */
+  async createCompositions(
+    fastify: PluginFastifyInstance,
+    requestData: FrontendPayloadRequestData,
+    compositionBodies: CompositionBody[],
+    userId: string,
+  ): Promise<FrontendPayload<CompositionType[]>> {
+    const compositions = await this._createCompositions(
+      fastify,
+      compositionBodies,
+      userId,
+    )
+
+    const payload = await createCompositionPayload(
+      fastify,
+      compositions,
+      requestData,
+    )
+
+    fastify.emit("compositionsCreated", payload)
+
     return payload
   }
 }

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/index.ts

@@ -4,6 +4,7 @@ import getAll from "./route.composition.getAll"
 import hardDelete from "./route.composition.hardDelete"
 import patch from "./route.composition.patch"
 import post from "./route.composition.post"
+import postBulk from "./route.composition.post.bulk"
 import remove from "./route.composition.remove"
 import restore from "./route.composition.restore"
 
@@ -13,6 +14,7 @@ const registerRoutes = async (fastify: PluginFastifyInstance) => {
   await fastify.patch("/composition/:_id", patch(fastify))
   await fastify.patch("/composition/:_id/restore", restore(fastify))
   await fastify.post("/composition", post(fastify))
+  await fastify.post("/composition/bulk", postBulk(fastify))
   await fastify.delete("/composition/:_id", remove(fastify))
   await fastify.delete("/composition/:_id/hard", hardDelete(fastify))
 }

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.get.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -39,7 +41,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.getAll.ts

@@ -1,6 +1,8 @@
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const compositionService = fastify.custom.compositionService
 
@@ -21,7 +23,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRead",
     },

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.hardDelete.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -18,29 +19,25 @@ export default (fastify: PluginFastifyInstance) => {
     }>,
     reply: FastifyReply,
   ) => {
-    if (req.user.isAdmin) {
-      try {
-        const { _id } = req.params
-
-        const payload = await compositionService.hardDeleteComposition(
-          fastify,
-          req.requestParams,
-          _id,
-        )
-
-        return payload
-      } catch (error: any) {
-        fastify.log.error(error.message)
-        return reply.internalServerError(error.message)
-      }
-    } else {
-      throw new ForbiddenError("Only admins can hard delete this core datatype")
+    try {
+      const { _id } = req.params
+
+      const payload = await compositionService.hardDeleteComposition(
+        fastify,
+        req.requestParams,
+        _id,
+      )
+
+      return payload
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return reply.internalServerError(error.message)
     }
   }
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataHardDelete",
       broadcastChannels: ["compositionHardDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.patch.ts

@@ -5,6 +5,8 @@ import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 import { compositionUpdateSchema } from "../composition.schema"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -42,7 +44,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataUpdate",
       broadcastChannels: ["compositionUpdated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.post.bulk.ts

@@ -0,0 +1,60 @@
+import type { CompositionBody } from "../composition.service"
+import type { FastifyReply, FastifyRequest } from "fastify"
+import type { PluginFastifyInstance } from "types"
+import { compositionCreateSchema } from "../composition.schema"
+
+const permissions = ["user.isAdmin"]
+
+export default (fastify: PluginFastifyInstance) => {
+  const compositionService = fastify.custom.compositionService
+
+  const handler = async (
+    req: FastifyRequest<{
+      Body: CompositionBody[]
+    }>,
+    reply: FastifyReply,
+  ) => {
+    try {
+      // Validate that body is an array
+      if (!Array.isArray(req.body)) {
+        return reply.badRequest("Request body must be an array of compositions")
+      }
+
+      // Validate that array is not empty
+      if (req.body.length === 0) {
+        return reply.badRequest("Request body cannot be an empty array")
+      }
+
+      const payload = await compositionService.createCompositions(
+        fastify,
+        req.requestParams,
+        req.body,
+        req.user._id,
+      )
+
+      return payload
+    } catch (error: any) {
+      fastify.log.error(error.message)
+
+      return reply.internalServerError(error.message)
+    }
+  }
+
+  return {
+    handler,
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
+    config: {
+      type: "dataCreate",
+      broadcastChannels: ["compositionsCreated"],
+    },
+    schema: {
+      summary: "Create multiple compositions in bulk",
+      tags: ["core/composition"],
+      body: {
+        type: "array",
+        items: compositionCreateSchema,
+        minItems: 1,
+      },
+    },
+  }
+}

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.post.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { compositionCreateSchema } from "../composition.schema"
 
+const permissions = ["user.isAdmin"]
+
 export default (fastify: PluginFastifyInstance) => {
   const compositionService = fastify.custom.compositionService
 
@@ -30,7 +32,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataCreate",
       broadcastChannels: ["compositionCreated"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.remove.ts

@@ -3,6 +3,8 @@ import type { FastifyReply, FastifyRequest } from "fastify"
 import type { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
 
+const permissions = ["user.isAdmin"]
+
 const ParamsSchema = Type.Object({
   _id: Type.String(),
 })
@@ -35,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataDelete",
       broadcastChannels: ["compositionDeleted"],

package/services/backend/src/corePlugins/raclette__core/backend/datatypes/composition/routes/route.composition.restore.ts

@@ -2,7 +2,8 @@ import type { Static } from "@sinclair/typebox"
 import type { FastifyReply, FastifyRequest } from "fastify"
 import { PluginFastifyInstance } from "types"
 import { Type } from "@sinclair/typebox"
-import { ForbiddenError } from "@/utils/errors"
+
+const permissions = ["user.isAdmin"]
 
 const ParamsSchema = Type.Object({
   _id: Type.String(),
@@ -17,21 +18,17 @@ export default (fastify: PluginFastifyInstance) => {
     reply: FastifyReply,
   ) => {
     try {
-      if (req.user.isAdmin) {
-        const { _id } = req.params
+      const { _id } = req.params
 
-        const payload = await compositionService.updateComposition(
-          fastify,
-          req.requestParams,
-          _id,
-          { isDeleted: false },
-          req.user._id,
-        )
+      const payload = await compositionService.updateComposition(
+        fastify,
+        req.requestParams,
+        _id,
+        { isDeleted: false },
+        req.user._id,
+      )
 
-        return payload
-      } else {
-        throw new ForbiddenError("Only admins can restore this core datatype")
-      }
+      return payload
     } catch (error: any) {
       fastify.log.error(error.message)
       return reply.internalServerError(error.message)
@@ -40,7 +37,7 @@ export default (fastify: PluginFastifyInstance) => {
 
   return {
     handler,
-    onRequest: [fastify.authenticate],
+    onRequest: [fastify.authenticate, fastify.checkPermissions(permissions)],
     config: {
       type: "dataRestore",
       broadcastChannels: ["compositionRestored"],